start to track down the 'peer has invalid cert' bug

svn:r623

1 files changed, 15 insertions, 5 deletions

diff --git a/src/common/tortls.c b/src/common/tortls.c
index 5c65d59981..5882e0c786 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -463,22 +463,32 @@ tor_tls_verify(tor_tls *tls)
     return NULL;
   
   now = time(NULL);
-  if (X509_cmp_time(X509_get_notBefore(cert), &now) > 0)
+  if (X509_cmp_time(X509_get_notBefore(cert), &now) > 0) {
+    log_fn(LOG_WARN,"X509_get_notBefore(cert) is in the future");
     goto done;
-  if (X509_cmp_time(X509_get_notAfter(cert), &now) < 0)
+  }
+  if (X509_cmp_time(X509_get_notAfter(cert), &now) < 0) {
+    log_fn(LOG_WARN,"X509_get_notAfter(cert) is in the past");
     goto done;
+  }
   
   /* Get the public key. */
-  if (!(pkey = X509_get_pubkey(cert)))
+  if (!(pkey = X509_get_pubkey(cert))) {
+    log_fn(LOG_WARN,"X509_get_pubkey returned null");
     goto done;
-  if (X509_verify(cert, pkey) <= 0)
+  }
+  if (X509_verify(cert, pkey) <= 0) {
+    log_fn(LOG_WARN,"X509_verify on cert and pkey returned <= 0");
     goto done;
+  }
 
   rsa = EVP_PKEY_get1_RSA(pkey);
   EVP_PKEY_free(pkey);
   pkey = NULL;
-  if (!rsa)
+  if (!rsa) {
+    log_fn(LOG_WARN,"EVP_PKEY_get1_RSA(pkey) returned null");
     goto done;
+  }
 
   r = _crypto_new_pk_env_rsa(rsa);
   rsa = NULL;